[Autogenerated] whenever I advise any organization about PC I.
D.
S s compliance have a really simple strategy,
which is that I want the organization to do as little PC ideas us as
possible unless the organization is in the business of storing,
processing and transmitting payment card data.
A.
That's the way it makes its revenue.
There are three reasons I take this approach personally.
By reducing the footprint of systems that store
process or transmit cardholder data,
we automatically reduce the attack surface on the risk
minimizing the number of systems,
networks and applications that a criminal can attack to
steal cardholder data increases our ability to protect
them from such a hostile attack.
Secondly, PC idea says compliance is really expensive to maintain,
and this is what most organizations fail to
understand where they start compliance.
Journey Getting compliant is only half the battle.
Maintaining compliance requires dedication personnel systems on
proactive assessments and finally having a large Kartal.
The data environment typically reduces an organization's ability to
change quickly because every change the business is,
it changed the cardholder data environment,
which then becomes a mini PC I project on its own.
So for these three key reasons.
My approach to try to reduce the size of the cardinal,
the data environment rather than trying to apply PC
idea says to the as is systems, networks and applications.
And when we talk about reducing the size of the cardholder data environments,
there are typically four things that weaken.
Do the first and most powerful is just delete cardholder
data that doesn't need to be stored.
Organizations typically used to keep lots of cardholder data,
but nowadays often there's no need.
If ever the real card numbers needed,
it could be retreat from an acquirer or a payment service provider on
refunds can usually be managed against transaction references.
So my first strategy, once I found all the cardholder data in an organization,
is to argue strongly that it should be deleted and then make people
justify why it needs to be kept the second powerful technique in
reducing the site of an organization's Kartal.
The data environment is to pass the problem to somebody else
that specializes in securing cardholder data,
so work out what business processes can be outsourced to PC idea,
says compliant service providers.
Often,
you'll also find a business benefit in this because the payment
service provider is not only looking after security,
but the payments of his brother's constantly innovating how
payments can be accepted and process.
The third option often complements the consideration of outsourcing,
and that's to look at whether there's a better way of running
a particular payment processing related business process that
might be a business process.
Change your technology chase that supports the business process Change.
Finally, if there's no way of changing business processes,
deleting cardholder data or outsourcing the problem,
then it's time to work out.
If it is possible to segmental re architect networks and
systems to create an isolated cuddle, the data environment segmenting the card.
All the data environment from other systems and networks
means that the entire organizations, networks and no in scope.
So you'd need to go back to the as is picture that describes the flow of
payment card data between applications and across networks.
Toe work out how the cardholder data environment could be
segmented from the rest of the organizations networks.
Typically, this is going to entail segmentation by creating networks,
zones separated by firewalls.
Let's look a couple of simple examples of scope reduction